Security is not a product, but a process.

learn more… | top users | synonyms (1)

1
vote
1answer
67 views

How can I modify my cgi to most effectively respond_to/block/whatever a ddos attack? [closed]

I am under DDoS. What can I do? already addresses this kind of "canonical question", but I think I'm asking a distinguishable variant, as described below. But please advise if this post inappropriate. ...
2
votes
0answers
34 views

SELinux preventing access to /var/log due to Docker

I have a Docker container that should read logs, including those from the host itself. So I mount the volume /var/log using the z flag. This changes the SELinux context on the files inside /var/log ...
7
votes
2answers
190 views

How to ensure integrity and security enforcing signed unmodified RPM package?

There is a way to verify files related to specific package against original RPM content: # Verify `vsftpd` package. rpm -V vsftpd How to complete the chain and verify that rpm command itself hasn't ...
6
votes
2answers
313 views

What does 'Log on as a Service' actually mean?

I am building Group Policy for a new domain that we are migrating to. In our current environment the settings Log on as a Service is set at the Server OU level - which has about a hundred Service ...
4
votes
1answer
250 views

Where does Credential Manager store credentials on the file system?

I want to clear a users stored credentials on a remote machine. Without having to have the user login and open the Cred manager GUI or run CMDKEY with them logged in. Is there a place on the file ...
0
votes
0answers
19 views

Website was hacked but only 1 domain [duplicate]

I recently found out that one of my Domains (which was only a empty Wordpress installation), was hacked. The website didn't show the wordpress installation anymore, instead there was just a website ...
1
vote
1answer
39 views

How to secure a 'public' sftp?

I have a server which enables some users of my services to upload files using SFTP. When I talk about users, I can neither be sure who they are nor how many have access. I have set up the access as ...
2
votes
2answers
368 views

Configure same Internet Explorer zone mappings with and without ESC via GPO

Our Active Directory domain consisting of Windows Server 2012 R2 servers and Windows 7 workstations configures Internet Explorer security zones using this Group Policy setting: Computer Configuration/...
1
vote
3answers
95 views

Secure Administration AD Domain

I have a project to securize my Active Directory infrastructure. To do that, one of my colleague told me about the possibility to create another AD domain in the forrest just for administration. That ...
1
vote
0answers
22 views

Win Server 2012 R2. Apply security GPO to local users on a specific machine

We have a "demo" machine which we use for providing remote access to demo software as a local user. Is there a way to hide and deny access to everything except the user folder using a GPO?
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
1
vote
2answers
102 views

WMI Remote “Access Denied”

I can no longer remote access WMI on anything in my environment (10/8.1/XP/7 workstations). Here some specifics: 1) I am a Domain Admin and "MRT" is my user and password "mmmmn". 2) Since this ...
0
votes
0answers
12 views

Secure an external linux distro

I have a fairly complex situation, I have researched all the parts required before asking this question. I am trying to make a bootable linux distro on which I have an app that is located on an ...
0
votes
0answers
12 views

Error with security constraint in Tomcat

I have a problem setting up a login with password in a web application, but returns me a 404 error when I try to access the website. My first step was add a new role and user in tomcat-users.xml: &...
0
votes
0answers
15 views

RSH from Linux to WIN7 and access COM port

I have a script(run on a Linux machine) , and does the following rsh to a Windoes machine (rsh XX.XX.XX.XX CMD) cd to a directory (cd YY) run a script (say ZZ.pl --someargument) it runs fine when ...
1
vote
1answer
36 views

apache LimitRequestBody equivalent for haproxy

recently we migrate our http load balancers from apache to haproxy (http mode) for security reasons we use LimitRequestBody in apache configurations to control requests size is there any equivalent ...
0
votes
0answers
33 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
1
vote
1answer
24 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
0
votes
1answer
27 views

Do “Old Passwords” have an expiration?

There are some systems that keep track of "old passwords" for increased security, like Databases, Domain Controllers, personal pages (Like Facebook) etc. Do these "old passwords" have an expiration? ...
0
votes
1answer
31 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
0
votes
2answers
41 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
-1
votes
1answer
29 views

FTP Port Protocol Type

I recently switched to a different VPN provider, therefore did a fresh server installation. Before I proceed, please keep in mind that I am not super experienced with server stuff. I am having a ...
0
votes
1answer
38 views

Secure way of granting access to production database

We are currently using the FedEx Ship Manager in our warehouse and would like to automate the process of entering customer shipping information automatically. Inside the ship manager there is an ...
0
votes
0answers
42 views

Tornado server on port 80/443, any issues?

I would like to run an application based on the Tornado web server in a production environment. The performance requirements are low. Since I don't need a load balancer, I wonder if it is OK to have ...
0
votes
0answers
29 views

VPN revocation error?

I have managed to successfully configure a SSTP VPN connection on my internal client PC, but only through registry fixes. I keep getting this error relating to checking to see if the server has been ...
3
votes
1answer
27 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
1
vote
1answer
68 views

Tomcat 8.0 - tomcat-users file being ignored, failing to restrict access to manager app

My tomcat server is presently running the manager app unprotected. We would like to continue using this as our primary means of starting, stopping and deploying applications. Our tomcat-users file ...
0
votes
1answer
80 views

Windows Server 2012 - How to get the username/password of an IP that is trying to connect using RDS?

I'm new to server admin, hence my apologies if this is a very basic question. I was going through my server's event log when I noticed under 'Application and Service Logs > Microsoft > Windows > ...
1
vote
0answers
43 views

Multiple IPs for one server to switch it in case of DoS / DDoS?

I'll run a server to secure a blockchain network (many servers with exposed IPs - no domains!). There will be only SSH, Fail2Ban, UFW, MONIT and the needed blockchain-client running on the server. ...
1
vote
1answer
55 views

`yum-security` functionality for CentOS?

The question here is similar, but not identical, to my (broader) question, which is: TLD;DR version Are there any tools for CentOS 6 (preferably in the base or EPEL repos) which provide any or all ...
32
votes
2answers
4k views

Network printer exploited (read: hacked) to print antisemitic documents. How to fix?

I'm unsure if this should be asked here or over on security.stackexchange.com... Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print ...
1
vote
0answers
37 views

Enabling console login on CentOS

I've inherited a CentOS system where I can't login via the console. I can ssh to the machine and login, but not via the console. How do I go about enabling console logins?
-2
votes
1answer
75 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
2
votes
1answer
18 views

Insider threat and Office 365 - STIGs or similar results?

Office 365 is a convenient way to keep work in-synch between multiple computers and smart phones. However, for cases where one is contractually obligated to safe guard and protect a client data and ...
0
votes
2answers
116 views

Gateway Anti-Virus vs Desktop Anti-Virus

I need your help with a question on Gateway Anti-Virus and Desktop/Server Anti-virus. The example I have is the following: You have a network of 50 machines (Desktops/Servers) which includes a ...
1
vote
2answers
57 views

Is Office365 Message Encryption actually secure?

I'm looking at implementing Office365 Message Encryption for our organization. My question is this: is it actually more secure than regular (unencrypted) email for messages sent to users outside the ...
2
votes
2answers
93 views

Run command after N failed local login attempts

Any good ways of running a linux command (shell script for instance) when N failed local login attempts happens? Maybe using pam_tally?
2
votes
2answers
64 views

Gracefully Killing Off SSL 2&3

In the light of POODLE we have an urgent requirement to turn off SSL2/3 and TLS 1.0 on our public-facing webservers. However we're a public sector body and around 5-10% of visits to our sites are made ...
0
votes
0answers
66 views

Docker / LXC and PCI-DSS Compliance

We are in payment space and we have built out a lot of our processes in Docker for development environment purposes. Now, we are thinking about converting our production environment which is in Xen (...
1
vote
0answers
47 views

Authentification methods for non-public facing websites

We have two different kinds of websites in our company, one of those are public-faced websites where users have to have access without serverbased authentication (anonymous auth.) and other websites ...
0
votes
0answers
79 views

Authentication Configuration with IIS 8.5 on Windows Server 2012

I have a site hosted using IIS on a Windows Server 2012 R2 server. The application is configured to use an application pool that uses the NetworkService account as the application pool identity. The ...
-4
votes
2answers
51 views

Config to allow SQL Server to be connected through CloudFlare?

I have already known the risk of exposing SQL Server database on the Internet, but please look at my situation: I have two instances of SQL Server: production (default instance SQLEXPRESS) and dev (...
0
votes
0answers
27 views

Copy .pub keys to Gitolite Server, university environment

I am a new Technical Officer for a South African university, and being a bit green, I'm not sure if this is the perfect place for this. Please let me know if it is not. The problem I have a Gitolite ...
6
votes
1answer
183 views

Should /usr/local/bin be owned by root?

Package manager Homebrew (I'm on OS X, but I'm curious about Unix-based security in general, as it pertains to directory permissions) set the owner of /usr/local/bin to my user (it's root by default, ...
1
vote
1answer
97 views

Mutual SSL authentication - client certificate vs server certificate

I am setting up a web application which will connect to a remote web service and is required to use a client certificate. My web app uses HTTPS to connect and I have it configured with my existing ...
0
votes
1answer
61 views

icacls adding SID instead of friendly name [closed]

I need to apply the icacls command from a server in the network, for example, server001 to a folder that is on server002. The objective is to add a local security group of server002 on a folder that ...
8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: -...
1
vote
1answer
26 views

Setting up BART in a Solaris non-global zone (aka Solaris Zone)

So my question is about running BART (The Solaris Basic Audit Reporting Tool) inside of a Solaris non-global zone. I'm confused on this subject due to I have been reading a lot of conflicting views, ...
0
votes
0answers
15 views

How to find server hacker [duplicate]

I have WHM CPanel and cxs plugin installed to scan for malicious scripts. Today I just got notified that a file has been uploaded to my server: Scanning web upload script file... Time ...
-1
votes
1answer
28 views

Getting file size before download on a proxy server [closed]

We're working on building a multithreaded proxy file server in C, where we receive a request and retrieve it from another location using the libcurl library. The library gives you the option of ...